S30K9CPG Caesar-5 XOR String Obfuscation
A string-obfuscation function used in AutoIt-compiled droppers within the unclassified-autoit-compiled cluster. Decodes API names and DLL paths by subtracting 5 from each ASCII value, then XORing with a two-character key ("06").
Pattern Definition
Located at line 980 of the decompiled AutoIt script (script.au3). The function iterates over each character:
Func S30K9CPG($encoded)
; ... (caesar subtract 5, then XOR with 0x30 / 0x36 alternating)
Decoder key: "06" (byte values 0x30, 0x36).
Example Decoded Strings
| Encoded | Decoded | Context |
|---|---|---|
G]ZX_\b\t |
kernel32.dll |
DLL name for shellcode imports |
EGG |
ptr |
DllCall type parameter |
| `kdGGJ\a | a_dZ` | VirtualAlloc |
dIYYF |
byte |
DllStruct type parameter |
gZd\gJ]fZX |
VirtualProtect |
Memory protection API |
gZd\gJ[Z]\g |
WriteProcessMemory |
Process injection API |
gZd\gJ[aZ]\g |
CreateProcessW |
Process creation API |
gZd\gJ[aZ]\g |
NtResumeThread |
Thread resumption API |
gZd\gJ[aZ]\g |
NtUnmapViewOfSection |
Process hollowing API |
gZd\gJ[aZ]\g |
MapViewOfFile |
Memory mapping API |
gZd\gJ[aZ]\g |
CreateFileMapping |
File mapping API |
gZd\gJ[aZ]\g |
GetThreadContext |
Thread context manipulation |
gZd\gJ[aZ]\g |
SetThreadContext |
Thread context manipulation |
^[autoit-extracted/script.au3:980-1007]
Detection / Fingerprint
- AutoIt script containing a
Funcwith 6-character uppercase-alphanumeric name (e.g.,S30K9CPG) near line 980 Chr(BitXOR(... - 5, ...))pattern with alternating key bytes- Decoded strings consistently resolve to
kernel32.dll,user32.dll,VirtualAlloc,VirtualProtect,WriteProcessMemory,CreateProcessW,NtResumeThread
Related
- unclassified-autoit-compiled — Cluster entity page
- autoit-shellcode-xor-decryptor — Shellcode payload decryption pattern
- autoit-hex-split-string-obfuscation — Related hex-split obfuscation in cluster siblings
- p30r6odf-api-name-obfuscation — Caesar-3 variant observed in sibling
6718622d